Our users currently log into our org using their salesforce username and password credentials along with their registered verification method of choice for Salesforce's own MFA prompt.

We're now in the testing phase of an SSO configuration that's implemented with an OpenID Connect auth provider. Since this auth. provider has MFA built in, we're now hoping to turn off Salesforce's MFA prompt for users who log in from this auth. provider. We've so far applied the following configuration:

  • Profiles Session Security Level Required at Login set to High Assurance
  • Session Security Levels for the auth. provider in question moved to High Assurance

However, our testing shows that Salesforce continues to prompt for MFA if the user has previously registered a verification method, resulting in poor UX due to double MFA prompts.

Is this normal? Do registered verification methods have to be disconnected first?

New users who login via auth provider AND haven't previously registered MFA aren't prompted by SFDC to set-up MFA.

1 Answer 1


If your SSO has MFA, you're in compliance with the SFDC security policy to contractually provide MFA. IMO you can just take "Session Security Level Required at Login" level down from high assurance.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .